Report the Tailscale device as removed only when it was, instead of whenever the toggle was on

Partnership/partnership_offboard.sh

@@ -156,6 +156,7 @@ source "$SCRIPTS_ROOT/Plugin/$PLATFORM/Partnership/containers.sh"
 # ── Parse flags ───────────────────────────────────────────────────────────────────────────────
 REASON="manual"
 STEP_DISABLE_RSYNC_OK=true   # both paths report it; only the mirror path re-initialised it
+TAILSCALE_REMOVED=false      # set only when remove_tailscale_device actually succeeds
 FILTERED_ARGS=()
 
 for arg in "$@"; do
@@ -590,7 +591,13 @@ if [[ "${PARTNERSHIP_REMOVE_TAILSCALE:-true}" == true ]]; then
             trap - SIGTERM SIGINT
         fi
     fi
-    remove_tailscale_device "$MIRROR"
+    # Outcome recorded, not assumed. remove_tailscale_device returns 1 when TAILSCALE_API_KEY or
+    # TAILSCALE_TAILNET is unset — it warns "skipping Tailscale removal" and the summary went on
+    # to report "removed ✅" anyway, so an offboard that left the device on the tailnet said it
+    # had taken it off. Neither key is configured here, so that was the case on every run.
+    if remove_tailscale_device "$MIRROR"; then
+        TAILSCALE_REMOVED=true
+    fi
 fi
 
 # Backup handover notification
@@ -638,8 +645,13 @@ echo "  Step 9  — Keys revoked:   $(_revoke_status)"
 echo "  Step 10 — State:          INACTIVE ✅"
 echo ""
 echo "  Blocklist: $MIRROR blocked — re-onboard to permit access again ✅"
-[[ "${PARTNERSHIP_REMOVE_TAILSCALE:-true}" == true ]] && \
-    echo "  Tailscale:   $MIRROR removed ✅"
+if [[ "${PARTNERSHIP_REMOVE_TAILSCALE:-true}" == true ]]; then
+    if [[ "$TAILSCALE_REMOVED" == true ]]; then
+        echo "  Tailscale:   $MIRROR removed ✅"
+    else
+        echo "  Tailscale:   $MIRROR NOT removed ⚠ — still on the tailnet (needs TAILSCALE_API_KEY + TAILSCALE_TAILNET)"
+    fi
+fi
 # Named because it is the one partnership switch neither onboard nor offboard moves, so it
 # survives an offboard still true and there is nothing else that would ever mention it.
 [[ "${FALLBACK_ENABLED:-false}" == true ]] && \